- Data drives the internet, and personal data is a part of that. A user’s personal data may be collected by apps, online services and devices they use. This data can take a number of different forms, from personal details that a user gives about themselves in order to sign up to an online product/service (e.g. name, email address) to personal data disclosed through the use of a service (e.g. adding personal details to an online profile/account, uploading photos or videos of themselves or others).
- Other types of personal data may also be collected. These can include how someone uses a device or service (such as how long someone spent on a service or watching a video, the time they logged in, the actions they took on the service, products that were browsed on a shopping site), the approximate geographical location of the user or their device, details of how they are connected to the internet (such as their IP address or service provider) as well as technical specifications of the device being used (such as the model type and operating system). Some of this usage data may be anonymised so that it cannot be traced back to an individual, other usage data may be explicitly linked to an individual.
- The personal and usage data collected about a person can affect their experience when using online apps, games and services. It may affect the types of adverts that are displayed on the service. On shopping apps and platforms it may affect the products that are recommended by the service. On social networks, it can also affect recommendations of things to watch or interact with, as well as suggestions of other users to connect with.
- Under the General Data Protection Regulation (GDPR) consent must be sought by online services in order for personal data of a child to be collected and processed. The age of consent varies between EU states from 13 to 16. Services must have a lawful basis for collecting personal data of children, and children have the same rights as adults over their personal data; including accessing their data, objecting to it being collected and requesting to have it erased.
- Terms and Conditions (also known as ‘Terms of Service/Terms of Use’) and privacy policies lay out how data is collected and used by an online service. Where services are designed for children, these should be written in a way that children can understand them.
Advice:
- Personal data is valuable online – for individuals and companies. Talk to your students about the types of data that might be collected online (including usage data) and how personal data can change the things they see or experience online. Encourage them to share examples where they have recognised their data has changed their experience (such as when adverts on websites display products they may have browsed).
- Investigate the Terms and Conditions and privacy policies for the popular services your students may use. This will help you become more aware of what types of data are collected and how they are used. Greater awareness can help you more confidently discuss data collection with your students. It is also wise to check the terms for online services you use both professionally and personally – are you happy with the way your personal data is collected and processed?
- Encourage your students to always work together with a parent/carer (or another trusted adult) when signing up to a new app/game or create an online account. You can advise parents/carers to use these opportunities to learn more about how it works as well as discuss safe and positive use with their child.
- Work with your students to help them understand that, just like adults, they have a number of key rights related to their data under the GDPR.
These include:- The right to be informed of how their data is collected and used
- The right to access their data collected by a company
- The right to have inaccurate or incomplete personal data rectified
- The right to erasure of their personal data
- The right to restrict processing of their data
- The right to data portability – to move their data from one service to another of the same type
- The right to object to personal data processing
- Rights around automatic data processing and profiling